Fallback Access Control List for Network Element TCAM Updates

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

The challenge in network elements is that updating access control lists (ACLs) can take tens or hundreds of milliseconds, causing issues with traffic processing during the transition, as retaining both old and new ACLs exceeds memory capacity, leading to the need for either dropping or allowing all traffic, which are undesirable solutions, especially in scenarios like DDOS mitigation where the lists are long and cannot fit simultaneously.

Innovation Solution

Implementing a fallback ACL that is a separate set of rules configured during the update period, allowing the network element to process traffic without completely dropping or allowing all traffic, by using a subset or disjoint set of rules that can deny or permit specific traffic types, thereby providing protection without exceeding memory capacity.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If the network element retains both the old and new ACL in TCAM during the update process, then the ACL update can be performed, but the TCAM usage exceeds capacity

Engineering Contradiction:

ImproveACL update capabilityVSAvoidTCAM usage

Core Design Contradiction:

ReliabilityVSQuantity of substance

Solution Approach 1:

The patent divides the ACL update process into distinct phases: an active ACL, a standby ACL, and a fallback ACL. This segmentation allows the system to maintain multiple ACL versions without requiring all of them to simultaneously occupy full TCAM capacity, as they are loaded and activated sequentially rather than all at once.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The fallback ACL acts as an intermediary solution during the transition from the old ACL to the new ACL. When the new ACL cannot be fully loaded into TCAM, the fallback ACL provides a partial rule set that maintains essential security functions, serving as a mediator between the incomplete new ACL and the traffic filtering requirements.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Quantity of substance

If the network element drops all traffic during the ACL update, then the TCAM capacity constraint is satisfied, but traffic loss increases

Engineering Contradiction:

ImproveTCAM capacity utilizationVSAvoidTraffic processing continuity

Core Design Contradiction:

Quantity of substanceVSProductivity

Solution Approach 1:

The system performs preliminary actions by pre-loading the fallback ACL into TCAM before the new ACL update begins. This ensures that when the update occurs and TCAM capacity is constrained, the fallback ACL is already in place and can immediately begin filtering traffic, preventing the need to drop all traffic during the transition.

Inventive Principle:

Principle #10Preliminary action

3Productivity

If the network element permits all traffic during the ACL update, then traffic processing continuity is maintained, but security protection deteriorates

Engineering Contradiction:

ImproveTraffic processing continuityVSAvoidSecurity exposure during update

Core Design Contradiction:

ProductivityVSObject-affected harmful factors

Solution Approach 1:

The fallback ACL implements preliminary anti-action by pre-configuring defensive rules that block harmful traffic patterns before the new ACL is fully operational. This proactive measure ensures that even during the transition period when the new ACL is being loaded, malicious traffic is already being filtered by the fallback rules, preventing security exposure.

Inventive Principle:

Principle #9Preliminary anti-action

4Object-affected harmful factors

If the ACL list is made very long to provide comprehensive DDOS mitigation, then security protection is improved, but the ACL cannot fit in TCAM memory

Engineering Contradiction:

ImproveDDOS mitigation capabilityVSAvoidTCAM memory capacity

Core Design Contradiction:

Object-affected harmful factorsVSQuantity of substance

Solution Approach 1:

The comprehensive ACL is segmented into two parts: the fallback ACL containing the most critical security rules that fit within TCAM capacity, and the full new ACL that may exceed TCAM capacity. This segmentation allows the essential DDOS mitigation rules to be maintained in hardware (TCAM) while additional rules can be stored in software memory and applied when needed.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The fallback ACL serves as an intermediary between the limited TCAM capacity and the comprehensive security requirements. It provides a subset of the full ACL rules that are most critical for DDOS mitigation, enabling the system to enforce essential security policies in hardware even when the complete rule set cannot be loaded into TCAM.

Inventive Principle:

Principle #24Intermediary (Mediator)

Data Source

PatentUS10263957B2System and method for a fallback access control list port configuration

Publication Date: 2019.04.16 ARISTA NETWORKS INC

AI summary

A method and apparatus of a device that installs a new access control list for a port of a network element is described. In an exemplary embodiment, a network element receives an indication that the first access control list for the port is to be updated with a second access control list and the port processes data communicated with port with the first access control list. In addition, the network element configures the port to use a fallback access control list, where the fallback access control list includes a plurality of rules and the port uses the fallback access control list to process data communicated with the port. Furthermore, the network element loads the second access control list for the port. The network element additionally configures the port to use the second access control list, wherein the port uses the second access control list to process data communicated with the port.